Authors: Robert Nešpůrek, Petr Bratský
The deadline of 17 December 2021 for the implementation of the Whistleblower Directive (Directive (EU) 2019/1937 of the European Parliament and of the Council) is fast approaching. Under the Directive, private entities with more than 50 employees and most public entities will have to introduce communication channels and processes for internal whistleblowing.
A number of global and major national companies already have centralised group-wide reporting systems in place and have relied on sufficiency of this global solution beyond 17 December 2021, but the European Commission has clearly rejected this interpretation.
The idea of a centralised reporting system was rejected by the European Commission in its interpretation guidelines responding to a joint letter from industry associations from several Member States.
The Commission explained that the Directive makes it clear that any private entity with more than 50 employees is required to implement an internal reporting system, regardless of whether or not the entity is part of a corporate group. Any other interpretation would be contra legem.
The Directive does not prohibit centralised group-wide whistleblowing systems, but these can only exist in parallel to reporting systems at the level of individual companies. The Commission has justified its opinion on the grounds that the system is more efficient if the problem is dealt with at the level of the company where the case was reported and by the different legal regulations that will be adopted at the national level. All Member States will have to respect this interpretation in implementing the Directive. Therefore, if you have more than 50 employees, you should start preparing for the implementation of your own whistleblowing system even if you already have a global whistleblowing system in place within your group.
Where subsidiaries have up to 249 employees, they may, in accordance with the Directive, pool the resources for investigating a report with their parent company, but the following conditions must be complied with, as interpreted by the Commission:
In the case of large companies, i.e. if the subsidiary has more than 249 employees, resource pooling is not allowed. Each such company must have established its own internal whistleblowing system that is independent of the group's central whistleblowing system and must have sufficient capacity available to deal with such notifications.
Even if you do not have systematic investigation sharing in place within the group, there may be situations in which dealing with reported breaches at the parent company level is the only effective solution. These are situations where the report relates to a structural problem within the group or multiple companies within the group and where the company at which the breach was reported does not have the competence to effectively resolve the problem. In such cases, as the European Commission explains, the whistleblower should be informed of this fact and asked to agree to the case being transferred within the group to an entity that is competent to resolve the problem. However, this entails considerable risks. If the whistleblower does not agree to the transfer of the reported matter, he or she must be allowed to withdraw the report and submit it through external channels, which in the case of the Czech Republic will be a newly established office within the Ministry of Justice. The group therefore risks losing control of the reported case and the related potential reputational damage, material and non-material damage, high costs, protracted litigation, and other adverse consequences.
For many global companies, the Commission's interpretation is surprising. The centralisation of whistleblowing systems allowed for a concentration of practices and experiences, a consistent approach to whistleblowing across the group, and efficient problem-solving at a lower cost.
Although the European Commission's interpretation is not binding, it will be interesting to see whether individual states will tend to oppose this interpretation and transpose the Directive into their legal systems more benevolently. It is already clear, however, that companies with more than 50 employees that do not put in place a workable whistleblowing system for their whistleblowers will risk having their whistleblowers report externally, to the authorities or sometimes directly to the media. And that is always the most painful solution for a company.
We therefore recommend that all groups review their centralised whistleblowing systems, decentralise them or implement new whistleblowing systems at the level of individual subsidiaries to comply with the requirements of the Directive. We believe that for smaller players a whistleblowing system can always be set up in a cost-effective and proportionate manner, taking into account the cost and size of the company and its internal workings. It will be good to use permitted forms of group-wide resource sharing and sometimes it will make sense in terms of cost and competences to outsource the management of the whistleblowing systems to a third party.
For more information on whistleblowing and the full range of our whistleblowing services, please visit the HAVEL & PARTNERS website. For our clients, we ensure the implementation of whistleblowing channels, and processes for receiving and verifying reports, we can take over the administration of the entire system and act as the party responsible for receiving reports and handling the whistleblowing process. As part of our services we can design a whistleblowing system for your company and/or group of companies so that it is functional, cost-effective and meets the new legal requirements.
